This disclosure relates to an embedded system, an information processing unit, and an image forming apparatus, and particularly to a technique for security improvement in firmware updates.
Recently, many multifunction peripherals combining multiple functions such as a copy function, a printer function, a scanner function, and a facsimile function have been introduced into office environments. To implement such various functions, a multifunction peripheral is configured as an embedded system. In other words, the various functions in a multifunction peripheral are described by a computer program, and are stored in a nonvolatile memory as firmware. A central processing unit (CPU) executes the program to control various hardware devices in the multifunction peripheral, thereby providing a desired function.
Firmware may be updated for the purpose of elimination of errors (bugs) discovered ex post facto or improvement and expansion of functions. In this case, if the firmware is updated to be altered illegally, the multifunction peripheral may not operate at all, or confidential information may be stolen from the multifunction peripheral. Thus, when the firmware is updated, the fact that new firmware to be installed is not illegally altered, i.e. genuineness of the new firmware, should be verifiable.
In this respect, for example, there is a technique for preventing the installation of any firmware that may be illegally altered by encrypting a hash value of the new firmware with a private key, giving the encrypted hash value to the new firmware as an electronic signature, and verifying the electronic signature using a public key when the new firmware is installed. Further, there is also proposed a technique for restricting installation or execution of software copied illegally by calculating a hash value of information unique to an executing device and an external memory, giving the hash value to software as an electronic signature, and verifying the electronic signature using a public key when the software is installed or executed.